The replacement solution worked for 3D Realms many years ago after a bunch of journalists, fansites, and forums would link to their game screenshots. When someone did, their image would be replaced with Duke Nukem dressed up as Uncle Sam, pointing at the screen, and captioned with something like "Duke wants you to host your own images"

Edit: you don't even need to write anything dynamic to receive the ping back, just have the script load an image from yoursite.com/specialprefix/the useresencodedbrowserurl/anythingelseinteresting/1.png then look in your server logs for any 404 errors with the prefix?

Correct me if I simply have missed it, but is there an official NPM package available? I have seen https://www.npmjs.com/package/sorttable and perhaps some of the sites would drop the script tag if "npm install --save-dev sorttable.js" is in the instructions and they have a build step for their JS anyway. Just thinking out loud.

"Thank you for using SortTable from https://www.kryogenix.org/code/browser/sorttable/. If you, the site owner, would like to use SortTable without this notice, please download the script from [here](URL link) and add it to your server."

If you want to get fancy you can serve the modified script only if it's being hot linked and the original script if it's being used on www.kryogenix.org - or another website that has permission to use the script.

It doesn't break their page if you take ten seconds to serve the JS, but it makes their page slow, and nobody likes a slow page. And it's pretty obvious where the slowdown is coming from.

If it's easy, make it fast from your site and slow if the referer doesn't match or isn't present. Or just make it always slow, whatever.

I disagree. Public CDNs (which is what I take the sentence to be referring to) can be convenient for prototyping, but should be completely avoided for production work. Due to HTTP/2+, cache partitioning, and the ease of private CDNs (which were difficult and expensive even ten years ago, whereas now it’s common for entire sites to be hosted on a private CDN), public CDNs no longer offer any benefit at all in most common/sensible scenarios, and negligible benefit in the near-worst-case scenario, but have performance costs (establishing an extra HTTPS connection) and introduce significant functionality and security risks.

For a good article with some more detail: https://httptoolkit.com/blog/public-cdn-risks/

Things like HTTP Referrer, coupled with a set of rolling dynamic headers so actual site visitors aren't impacted, or significant rate limiting, or a simple non-malicious HTTP widget injection that sends a simple message, stop the unauthorized hotlinking.

You could even take it a step further by evaluating at the packet header level but that's a bit of a setup.

Isn't so-called "hot" linking an intended and useful feature of the web? Linking to something directly so that you don't need to copy it to a new server and pollute the URL space with duplicate objects?

Maybe someone can invent a way of caching or replicating web content so it doesn't overload the original server and its internet connection. There might even be a business opportunity, "Caching Distribution Nodes" or something....

> There are many CDNs, and using resources served from them is not a bad thing. That’s not what I’m talking about

I see.

That being said, I like the idea of hierarchical URLs that could address anything on a web page, including items that are linked from elsewhere. Maybe something like:

https://example.org/page.html/resourcename.ext

Then you could easily reference a page where the original item is located, and browsers could easily go there.

http://www.glitchwrks.com/images/general/hotlink.gif

Mostly I had issues with folks hotlinking some of my higher resolution images in their own site/blog/forum posts and claiming it was their work. I set up the rewrite rules after noticing a big spike in bandwidth utilization and seeing a bunch of requests in the logs. Referrer took me back to the offending pieces.

It was suggested to use some sort of shock image instead, now that would be antisocial!

wtf

I've had people do this to me and then I go to update my stylesheet on my website and suddenly a ton of other websites I use are broken and I was like "wtf". After trying to get people to stop directly embedding it and realizing the problem was just too widespread, I ended up having to freeze an old copy of my stylesheet at the fixed URL that everyone was using and now I generate random URLs for my new stylesheet updates (that both look like something you shouldn't rely on and which do disappear later).

(FWIW, I will say that the random URLs are probably a better solution anyway as if you are going to have a stylesheet used by various pages of yours it is difficult to do an atomic upgrade of the resource and the pages that use it without momentarily breaking some content. My "random" URLs are actually hashes and it is honestly better than what I had before.)

1. Only if bandwidth is free. Which is not the case if you're sufficiently popular.

2. It makes you responsible for other people's web sites working correctly. Would you personally like to have that burden? The original article's poster isn't too happy about it.

3. It's bad practice because if the original host does not care about other people's web sites working correctly, who knows what your viewers will download next time? Perhaps a new and improved version that includes a bitcoin miner? Ok that's out of fashion. Perhaps a 0day exploit then?

4. Even if no bitcoin miner or 0day exploit, you're allowing a 3rd party to interact with your viewer. This is a privacy risk if you hotlink from the likes of Google or Facebook isn't it?